WO2011115168A1

WO2011115168A1 - Communication system, node, control server, communication method and program

Info

Publication number: WO2011115168A1
Application number: PCT/JP2011/056200
Authority: WO
Inventors: 靖伸千葉
Original assignee: 日本電気株式会社
Priority date: 2010-03-17
Filing date: 2011-03-16
Publication date: 2011-09-22
Also published as: JP5573942B2; RU2016113701A; AU2011228096B2; BR112012021765A2; KR101503450B1; JP2014027695A; CN102804715B; US20110307628A1; JP5768861B2; CN102804715A; KR20120135251A; EP2549692A1; RU2012144031A; KR101495126B1; KR20140004814A; JPWO2011115168A1; AU2011228096A1

Abstract

Provided are a communication system, a node, a control server, a communication method and a program which make it possible to set processing rules (flow entry) reliably and quickly. The communication system includes a node which receives a packet containing a series of processing rules constructed by listing processing rules to be set in a processing rule storage unit of a node in a data transfer network, and which sets processing rules in the processing rule storage unit thereof in accordance with the series of processing rules.

Description

Communication system, node, control server, communication method and program

[Description of related applications]
The present invention is based on the priority claim of Japanese Patent Application: Japanese Patent Application No. 2010-060898 (filed on Mar. 17, 2010), the entire contents of which are incorporated herein by reference. Shall.
The present invention relates to a communication system, a node, a control server, a communication method, and a program, and more particularly, to a communication system, a node, a control server, a communication method, and a program for realizing communication by transferring a packet by a node arranged in a network.

As shown in

Non-Patent Documents

1 and 2, in recent years, a technique called OpenFlow has been proposed. OpenFlow captures communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis. The OpenFlow switch that functions as a forwarding node includes a secure channel for communication with the OpenFlow controller, and operates according to a flow table that is appropriately added or rewritten from the OpenFlow controller. In the flow table, for each flow, a set of a rule (FlowKey; matching key) that matches the packet header, an action (Action) that defines the processing content, and flow statistical information (Stats) is defined (FIG. 24). reference).

FIG. 25 illustrates action names and action contents defined in Non-Patent Document 2. OUTPUT is an action for outputting a packet to a designated port (interface). SET_VLAN_VID to SET_TP_DST are actions for modifying the field of the packet header.

For example, when the OpenFlow switch receives the first packet (first packet), it searches the flow table for an entry having a rule (FlowKey) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch performs the processing content described in the action field of the entry on the received packet. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch forwards the received packet to the OpenFlow controller via the secure channel, and the source / destination of the received packet. To request the determination of the route of the packet based on the above, receive the flow entry that realizes this, and update the flow table.

The following analysis was made by the present inventors.
The OpenFlow controller that has received the request for determining the path of the received packet (see s2 Packet-In in FIG. 26) determines the transfer path of the received packet. In order to transfer the received packet and subsequent packets belonging to the same flow to the host (B), flow entries are set in all the open flow switches (node # 1 and node # 2 in FIG. 26) on the transfer path. There is a need to. For this reason, there is a problem that it takes time to start the transfer of user packets.

In addition, when the above flow entry is set using the OpenFlow protocol (see “4.6 FLOW Table Modulation Messages” in Non-Patent Document 2), communication between the OpenFlow controller and the OpenFlow switch may be delayed. The flow entry settings in some OpenFlow switches are not in time, and packets of the same flow are judged not to match the flow entries on the flow table in the OpenFlow switch on the route and received by the OpenFlow controller. There is also a problem that a request to create a flow entry for a packet is made. In addition, due to the delay in setting the flow entry, there is a problem that an unintended action is executed on a packet of the same flow because it matches an unintended flow entry on the flow table in the open flow switch on the route.

As the above countermeasure, as shown in FIG. 26, the (open flow) controller sends a flow entry to the nodes # 1 and # 2 (see FlowMod (Add) of s3 and s6 in FIG. 26) and opens. It is conceivable to transmit a Barrier Request defined in the flow protocol (see “5.3.6 Barrier Message” in Non-Patent Document 2 for s4 Barrier Request; Barrier Request / Reply in FIG. 26). The node that has received the Barrier Request responds with “Barrier Reply” (s5 in FIG. 26) with the processing executed before the Barrier Request is received. This allows the (open flow) controller to check whether the flow entry is set correctly. However, with this method, Barrier Request / Reply is exchanged with all nodes that have set flow entries, and the time until a user packet can be transmitted (s1 (User Packet) to s10 (User Packet) in FIG. 26). However, there is a problem that it becomes longer.

Another method is to check whether each node has a corresponding entry by using Stats Request / Reply instead of Barrier Request / Reply. In this case as well, the above Barrier Request / Reply is also used. As in the case of using, it is necessary to exchange whether or not the corresponding flow entry is set with all the nodes that set the flow entry, and the time until the user packet can be transmitted (s1 (User Packet in FIG. 26). ) To s10 (User Packet)) becomes long.

The present invention has been made in view of the circumstances described above, and an object of the present invention is to provide a communication system, a node, a control server, a communication method, and a communication method that can set a processing rule (flow entry) reliably and at high speed. To provide a program.

According to the first aspect of the present invention, a packet including a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of a data transfer network is received, and the own device is received from the processing rule sequence. There is provided a communication system including a node that extracts and sets a processing rule to be set in a processing rule storage unit.

According to a second aspect of the present invention, a packet including a processing rule sequence arranged in a data transfer network and configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network is received. A node for extracting and setting a processing rule to be set in the processing rule storage unit of the own apparatus from the processing rule string is provided.

According to the third aspect of the present invention, the processing rule to be set in the processing rule storage unit of the node of the data transfer network is based on the information included in the input packet received from the node arranged in the data transfer network. A control server is provided that creates processing rule sequences arranged side by side and transmits a packet including the processing rule sequence to a node that has transmitted the input packet.

According to a fourth aspect of the present invention, an input packet includes a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network, and a node of the data transfer network Includes a step of extracting and setting a processing rule to be set in the processing rule storage unit of the own apparatus from the processing rule sequence included in the input packet. The method is tied to a specific machine, the forwarding node that makes up the data transfer network.

According to a fifth aspect of the present invention, there is provided a program to be executed by a computer constituting a node arranged in a data transfer network, wherein processing rules to be set in a processing rule storage unit of the node of the data transfer network are arranged. Receiving a packet including a configured processing rule sequence, extracting a processing rule to be set in the own device from the processing rule sequence, and setting the extracted processing rule in a processing rule storage unit of the own device; A program for executing is provided. This program can be recorded on a computer-readable storage medium. That is, the present invention can be embodied as a computer program product. Further, the processing steps executed in the node by the program can also be grasped as a communication method.

According to a sixth aspect of the present invention, there is provided a program to be executed by a computer constituting a control server that controls a node arranged in a data transfer network, the input packet received from the node arranged in the data transfer network A processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network based on the information included in the data transfer network, and the processing rule to the node that transmitted the input packet A program for executing a process of transmitting a packet including a sequence is provided. This program can be recorded on a computer-readable storage medium. That is, the present invention can be embodied as a computer program product. Further, the processing steps executed in the control device by the program can be grasped as a communication method.

According to the present invention, a flow entry can be set reliably and at high speed in a node arranged in a data transfer network.

It is a figure which shows the structure of the communication system of the 1st Embodiment of this invention. It is a block diagram showing the structure of the node of the 1st Embodiment of this invention. It is a block diagram showing the structure of the control apparatus (controller) of the 1st Embodiment of this invention. It is a figure for demonstrating the structure of a packet with a process rule row | line | column. It is a figure which shows the structural example of the process rule row | line | column header of FIG. It is a flowchart showing operation | movement of the node of the 1st Embodiment of this invention. It is a flowchart showing operation | movement of the control apparatus (controller) of the 1st Embodiment of this invention. FIG. 3 is a reference diagram and a sequence diagram for explaining a series of flows in the communication system according to the first embodiment of the present invention. It is the reference figure and sequence diagram for demonstrating a series of flows in the communication system of the 2nd Embodiment of this invention. It is a figure showing the structure of the packet with the process rule sequence | sequence which a control apparatus (controller) and a node of the 2nd Embodiment of this invention send out to the next hop. It is a figure which shows the structural example of the process rule row | line | column header of FIG. It is a flowchart showing operation | movement of the control apparatus (controller) of the 2nd Embodiment of this invention. It is a flowchart showing operation | movement of the node of the 2nd Embodiment of this invention. It is the reference figure and sequence diagram for demonstrating a series of flows in the communication system of the 3rd Embodiment of this invention. It is a block diagram showing the structure of the node of the 3rd Embodiment of this invention. It is a flowchart showing operation | movement of the node of the 3rd Embodiment of this invention. It is a block diagram showing the structure of the node of the 4th Embodiment of this invention. It is a block diagram showing the structure of the control apparatus (controller) of the 4th Embodiment of this invention. It is a figure which shows the structural example of the process rule sequence header with a signature used in the 4th Embodiment of this invention. It is a flowchart showing operation | movement of the control apparatus (controller) of the 4th Embodiment of this invention. It is a flowchart showing operation | movement of the node of the 4th Embodiment of this invention. It is a reference figure for demonstrating a series of flows in the communication system of the 5th Embodiment of this invention. FIG. 23 is a sequence diagram corresponding to FIG. 22. It is a figure showing the structure of the entry set to the flow table of the node of the 1st-5th embodiment of this invention. It is a figure which shows the action name described in the nonpatent literature 2, and the content of action. It is the reference figure and sequence diagram for demonstrating a series of flows for setting a flow entry reliably using the open flow protocol of a nonpatent literature 2. FIG.

First, the outline of the present invention will be described. Hereinafter, the reference numerals of the drawings attached to this summary are merely examples for assisting understanding, and are not intended to be limited to the illustrated embodiments. The node of the communication system of the present invention has a function of taking out a processing rule to be set in its own processing rule storage unit from the processing rule sequence included in the packet and setting it in the processing rule storage unit of its own device. . Then, the node refers to the content set in its own processing rule storage unit including the set processing rule, searches for the processing rule that matches the received packet, and the processing content defined in the searched processing rule ( Packet rewrite, packet transfer, packet discard, etc.).

The processing rule sequence can be configured such that processing rules to be set in each processing rule storage unit of an arbitrary node on the data transfer network are arranged. As a method of specifying a processing rule to be set by each node in its processing rule storage unit from the processing rule sequence, a method of adding a node identifier to each processing rule, a process in the processing rule sequence A method of assigning the position of the rule to each node, a method in which each node takes out the processing rule at the head or tail according to the order of the processing rules in the processing rule string, and the like can be adopted.

The processing rule and the processing rule storage unit correspond to the flow entry and the flow table in the above-described OpenFlow technology, but can take other modes. For example, it is only necessary to search for a processing rule that matches the received packet and execute processing such as rewriting the header or outputting the packet from the designated port (see FIG. 25 and Non-Patent Document 2, pages 4 to 6, “3”). .3 Actions "," Table5 ").

Also, the control device (controller; 20 in FIG. 1) creates a packet including the processing rule sequence and transmits it to node # 1 (10 in FIG. 1), and node # 1 (10 in FIG. 1) It may be forwarded to the next hop node # 2 (10 in FIG. 1), or the node # 1 (10 in FIG. 1) receives the processing rule string from the control device (controller; 20 in FIG. 1) and receives the packet. And may be forwarded to the next hop node # 2 (10 in FIG. 1). Further, it is possible to adopt a configuration in which a dedicated device for receiving a necessary processing rule from the control device (controller; 20 in FIG. 1) and creating a processing rule string is provided. Further, among the nodes, a configuration in which a node located at a boundary with an external server or terminal has a function of receiving a plurality of processing rules from a control device (controller; 20 in FIG. 1) and creating the processing rule sequence. It can be adopted.

A node (node # 2 in FIG. 1 or nodes # 1 and # 2 in FIG. 1) that has received a packet including such a processing rule sequence is set in its processing rule storage unit from the processing rule sequence. The processing rule to be set is extracted by taking out the processing rule to be set and setting it in the processing rule storage unit of the device itself. This makes it possible to transfer subsequent user packets reliably and quickly without following the procedure shown in FIG. It should be noted that the processing rule added to the first packet may be deleted by the terminal node (node # 2 in FIG. 1).

[First Embodiment]
Next, a first embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing a configuration of a communication system according to the first embodiment of the present invention. Referring to FIG. 1, two nodes 10, a control device (controller) 20, and hosts (A) and (B) that communicate via the node 10 are shown. In the example of FIG. 1, two nodes 10, a control device (controller) 20, and two hosts (Host (A) and Host (B)) are shown. There can be any number.

FIG. 2 is a diagram showing a detailed configuration of the node 10. Referring to FIG. 2, the node 10 includes a control device communication unit 11 that communicates with the control device (controller) 20, a flow table management unit 12 that manages the flow table 13, a packet buffer 14, and a transfer processing unit 15. It is prepared for. Note that the node 10 does not necessarily include the packet buffer 14.

Further, the transfer processing unit 15 performs processing for setting a processing rule (flow entry) in the flow table 13 via the flow table management unit 12 in accordance with the processing rule setting information extracted by the flow setting information extraction unit 152. A flow setting information extraction unit 152 that extracts processing rule setting information from a processing rule sequence header added to a packet received as user traffic and outputs the processing rule setting information to the flow setting information processing unit 151; A table search unit that searches the flow table 13 and outputs the processing content (action) defined in the corresponding processing rule (flow entry) to the action execution unit 154 when the processing rule sequence header is not added to the packet. 153 and processing contents (actions) output from the table search unit 153 Constructed and a action execution unit 154 for execution. When there is no processing rule (flow entry) that matches the received packet as a result of the search of the flow table 13, the table search unit 153 buffers the received packet in the packet buffer 14 and controls the controller (controller) 20 In response to this, processing for requesting creation of a processing rule string is performed.

The node 10 as described above can be realized by a configuration in which the flow setting information processing unit 151 and the flow setting information extracting unit 152 are added to the OpenFlow switch.

FIG. 3 is a diagram showing a detailed configuration of the control device (controller) 20. Referring to FIG. 3, the control device (controller) 20 determines the connection relationship between the flow entry database (flow entry DB) 21 storing processing rules (flow entries) and the nodes 10 collected via the node communication unit 26. A topology management unit 22 that constructs network topology information based on the network topology information, and a route / action for determining a packet forwarding route and an action to be executed by the node 10 on the forwarding route based on the network topology information constructed by the topology managing unit 22 The flow calculated by the calculation unit 23 and the route / action calculation unit 23 is registered in the flow entry DB 21 as a processing rule (flow entry), and the flow responds to the processing rule (flow entry) addition or update request from the node 10. Entry management unit 24 and control message processing unit 2 When constituted by a node communication unit 26 that communicates with the node 10. Note that the flow entry database (flow entry DB) 21 can be omitted when there is no need to hold the processing rule (flow entry) instructing the node 10 to add or update. A configuration in which a flow entry database (flow entry DB) 21 is separately provided in an external server or the like can also be employed.

Further, the control message processing unit 25 analyzes the control message received from the node, and aggregates the message analysis / processing unit 251 that performs necessary processing and the processing rule (flow entry) output from the flow entry management unit 24. And a message generation unit 252 including a flow entry aggregation unit 253 that creates the processed rule sequence.

FIG. 4 is a diagram for explaining the configuration of a packet with a processing rule sequence created by the node 10 based on an instruction from the control device (controller) 20. In the example of FIG. 4, the packet 32 with the processing rule sequence has a configuration in which a processing rule sequence header 33 including the processing rule sequence is added to the head of the user packet 31.

FIG. 5 is a diagram showing a configuration example of the processing rule sequence header. In the example of FIG. 5, the processing rule column header 33 includes a MAC destination address (MAC DA), a MAC transmission source address (MAC SA), a higher protocol type (Ether Type), and a total header length (Total Length). Processing rule setting information with the fields from Last hop bitmap and Length to actions indicating the node of the last hop to be processed to remove the processing rule sequence from the attached packet as a unit, and the packet with the processing rule sequence are output. The output port bitmap (output port bitmap) indicating the power port (the node to which the packet with the processing rule sequence is to be transferred) is added for the number of nodes to be set.

DPID # 1 in FIG. 5 represents the identifier of the node 10. Ofp_match field to actions field store flow entry operation information to be executed by the node indicated by DPID # 1. The flow entry operation information related to the present invention will be described. In the ofp_match field, information corresponding to the matching key (FlowKey) of the flow entry shown in FIG. 24 is stored. Further, idle_timeout and hard_timeout store the lifetime (valid period) of the processing rule (flow entry). Actions stores the processing contents corresponding to the Actions of the flow entry shown in FIG.

Last hop bitmap indicates what number node is the last hop. For example, when the last hop bitmap is “10000000000000...” (The position of 1 indicates the node that is the last hop), the node of DPID # 1 in FIG. 5 becomes the last hop. Similarly, when the last hop bitmap is “00001000000000...” (The position of 1 indicates the node that is the last hop), the processing rule (flow entry) of the fifth flow entry operation information is used. The node that performs the setting is the last hop.

Similarly, the output port bitmap (output port bitmap) describes in which bitmap each node should output the packet with the processing rule sequence from the bitmap.

In this embodiment, the bit map employs a form indicating the last hop and the output destination port. However, if the node 10 is the last hop or the output destination can be specified, the node described above is used. Other forms such as providing a node identifier field describing the identifier may be employed.

The control device (controller) 20 as described above adds the processing rule sequence to the node 10 and the flow entry aggregation unit 253 that creates the processing rule sequence as described above in the OpenFlow controllers of

Non-Patent Documents

1 and 2. It can also be realized by adding a transmission function.

Subsequently, the operation of the node 10 and the control device (controller) 20 will be described. FIG. 6 is a flowchart showing the operation of the node 10. Referring to FIG. 6, when receiving a packet from the host or another node 10 (step S101), the node 10 attempts to extract a processing rule string from the received packet (step S102).

If the processing rule sequence can be extracted in step S102 (Yes in step S103), the node 10 extracts the processing rule (flow entry) to be set by itself from the processing rule sequence and sets it in the flow table 13. (Step S104). Next, the node 10 refers to the above-mentioned Last hop bitmap and confirms whether or not it is the last hop. If the node 10 determines that it is the last hop, the node 10 deletes the processing rule sequence from the received packet, extracts the original packet (user packet) (step S106), and is designated by the output port bitmap. Output from the selected port (step S107). If it is determined in step S105 that the node 10 is not the last hop, the node 10 outputs a packet with a processing rule sequence (packet with a processing rule sequence header) from the port specified in the output port bitmap. (Step S107).

On the other hand, if the processing rule string could not be extracted in step S102 (No in step S103), the node 10 refers to the flow table 13 and searches for a processing rule (flow entry) that matches the received packet (step). S108).

When a processing rule (flow entry) that matches the received packet is found as a result of the search of the flow table 13 (Yes in step S109), the node 10 displays the processing content (action) defined in the processing rule (flow entry). Execute (Step S110).

On the other hand, if the processing rule (flow entry) that matches the received packet is not found as a result of the search of the flow table 13 (No in step S109), the node 10 determines that an unknown packet has been received, and the packet ( (User packet) is stored in the packet buffer 14, and the received packet is transmitted to the control device (controller) 20 to request creation of a processing rule sequence (step S111). Thereafter, a response process including a process rule sequence is performed in the control device (controller) 20 according to the procedure shown in FIG. 7 (described later).

When receiving a processing rule (flow entry) setting instruction (Flow Mod (Add)) with a processing rule string attached from the control device (controller) 20, the node 10 stores Flow Mod (Add) in its own flow table 13. ), A processing rule (flow entry) is set (step S112).

Next, the node 10 checks whether or not the user packet is stored in the packet buffer 14 (step S113), and if stored (Yes in step S113), reads the user packet (step S114). The processing rule sequence received in step S112 is added to the user packet as a processing rule sequence header (step S115), and the processing content (action; here, processing defined in the set processing rule (flow entry) (Output from the designated port of the packet with the rule string header added) is executed (step S110). As a result, the packet with the processing rule sequence header is transferred to the next-hop node.

On the other hand, when the node 10 does not have the packet buffer 14 or the node 10 does not hold the user packet (No in step S113), the packet output instruction (Packet-Out) from the control device (controller) 20 is received. Received (step S116).

The node 10 that has received the packet output instruction (Packet-Out) checks whether or not the user packet is stored in the packet buffer 14 (step S117). If the user packet is stored (Yes in step S117), the node 10 The user packet is read (step S118), and the processing contents (action; here, the addition of the processing rule sequence header and the output of the packet to which the processing rule sequence header has been added are received from the packet output instruction (Packet-Out), Alternatively, a flow table search) is executed (step S110). If the user packet is not stored (No in step S117), the node 10 processes the user packet received together with the packet output instruction (Packet-Out) with the contents of the process received together with the packet output instruction (Packet-Out) (Packet-Out). Action: Here, the addition of the processing rule sequence header to the user packet and the output of the packet added with the processing rule sequence header or the search of the flow table are executed (step S110). As a result, the packet with the processing rule sequence header is transferred to the next-hop node.

Subsequently, the operation on the side of the control device (controller) 20 that has received an inquiry (processing rule sequence creation request) from the node 10 in step S111 of FIG. 6 will be described.

FIG. 7 is a flowchart showing the operation of the control device (controller) 20. Referring to FIG. 7, when the control device (controller) 20 receives an inquiry (processing rule string creation request) from the node 10 (step S001) as in step S111 of FIG. The constructed network topology information is acquired, and a packet transfer route is calculated (step S002).

As a result of calculation of the packet transfer route, the control device (controller) 20 except when it is determined that transfer cannot be performed due to reasons such as failure to create a route or failure of a node on the route (No in step S103). Calculates an action corresponding to the calculated transfer route (step S004), and generates a processing rule (flow entry) to be applied to each node 10 on the route (step S005).

Next, when the generation of the processing rule (flow entry) is completed, the flow entry aggregating unit 253 of the control device (controller) 20 sets the processing rule (flow entry) to a node downstream from the requesting node 10. Processing for consolidating the processing rules (flow entries) to be processed into the processing rule sequence is performed (step S006).

Next, the control device (controller) 20 generates a processing rule (flow entry) to be transmitted to the requesting node 10 of the processing rule (flow entry) (step S007), and attaches the processing rule sequence generated in step S006. Then, it transmits the processing rule (flow entry) to the requesting node 10 (step S008).

Thereafter, when the node 10 does not buffer the packet (No in step S009), the control device (controller) 20 issues a packet output instruction (Packet-Out) (step S010). This packet output instruction includes a packet to be output (packet received by Packet-In in step S001) and an action to be performed on the packet (creation of a packet with a processing rule sequence header added and output from a specified port) ) Or a packet to be output (packet received by Packet-In in step S001) and an action to be performed on the packet (flow table search). If the node 10 is buffering a packet (Yes in step S009), the packet output process is performed on the node 10 side as described in steps S113 and S114 in FIG. ) The processing on the 20 side is omitted.

FIG. 8 shows a case where the node # 1 receiving the user packet from the host (A) makes an inquiry to the control device (controller) 20 (request for creating a processing rule sequence), and then the user packet of the host (B) It is a reference figure and a sequence figure for explaining a series of flows until it is delivered.

As shown in FIG. 8, when the host (A) transmits a user packet addressed to the host (B) to the node # 1 (ST1 in FIG. 8; User Packet), the node # 1 processes the received packet. A rule string is not added, and it is determined that the packet is an unknown packet that does not have a processing rule (flow entry) that matches the flow table 13 (No in step S103 and No in step S109 in FIG. 6). An inquiry (processing rule string creation request) is made to the device (controller) 20 (ST2 in FIG. 8; Packet-In).

The control device (controller) 20 that has received the inquiry (processing rule sequence creation request) creates a processing rule sequence according to the flowchart of FIG. 7 and transmits it to the node # 1 together with the processing rule (flow entry) for the node # 1. (ST3 in FIG. 8; Flow Mod (Add) / w processing rule string).

The node # 1 sets the processing rule (flow entry) transmitted from the control device (controller) 20 in the flow table 13 of the own device, and the processing rule transmitted from the control device (controller) 20 in the received user packet. A column is added (ST4 in FIG. 8) and transmitted to the node # 2 (ST5 in FIG. 8; User Packet / w processing rule column).

The node # 2 that has received the user packet to which the processing rule sequence is added extracts the processing rule sequence from the received packet, extracts the processing rule (flow entry) to be set by the node # 2 therein, It is set (added) to the flow table 13 of its own device (ST6 in FIG. 8). Finally, the node # 2 removes the processing rule sequence from the user packet to which the processing rule sequence is added, and transmits the user packet to the destination host (B) (ST7 in FIG. 8; User Packet).

As described above, according to the present embodiment, the number of times that the control device (controller) 20 transmits a processing rule (flow entry) to the node 10 does not increase according to the number of nodes on the transfer path. After the first user packet is received (in the example of FIG. 8 once), the time until the setting of the flow entry in the node 10 on the route is completed can be shortened. In addition, a Flow Mod (Add) command with a processing rule sequence that is a key to a series of operations is transmitted by TCP (Transmission Control Protocol), and subsequent processing rules (flow entries) are set by the user on the route node. Since the processes are sequentially executed prior to the transfer of the packet, a situation in which the setting of the processing rule (flow entry) is delayed in some of the nodes described at the beginning does not occur.

Here, the processing rule (flow entry) is set for each node shown in FIG. 26 and the processing rule string (flow entry) is transmitted to the first node as shown in FIG. Compare the time required to set the flow entry. Hereinafter, each processing time / delay will be described by the following variables.
T _f : Flow setting processing time by FlowMod (Add) T _b : Barrier Request processing time T _sc : Node-controller delay T _cs : Controller-node delay T _c : Controller path calculation time T _l : Inter-node / node-host link Delay N: Number of flow setting target nodes

The required time T _setup0 until processing rules (flow entries) are set for all nodes by the method of FIG. 26 is calculated by the following equation. As is clear from the following equation, the time T _setup0 increases with the number N of nodes.
T _setup0 = T _sc + T _c + N (T _cs + T _f + T _b + T _sc + T _l )

On the other hand, according to the present invention, the required time T _setup until a processing rule (flow entry) is set for all nodes is calculated by the following equation.
T _setup = T _sc + T _c + T _cs + N (T _f + T _l )
As apparent from the comparison between the two equations, the present invention requires only one delay T _cs when setting the processing rule, and the processing time T _b + response delay T _sc for Barrier Request / Reply is This is advantageous in that it becomes unnecessary.

[Second Embodiment]
Next, a second embodiment of the present invention will be described in detail with reference to the drawings. In the first embodiment of the present invention described above, the control device (controller) 20 that has received the inquiry (processing rule sequence creation request) transmits a Flow Mod (Add) message, whereby the flow entry is sent to the first hop node. In this embodiment, another method that does not use the Flow Mod (Add) message is adopted. Note that the configurations of the node 10 and the control device (controller) 20 in the second embodiment are the same as those in the first embodiment, and a description thereof will be omitted.

FIG. 9 is a reference diagram and a sequence diagram for explaining a series of flows in the communication system according to the second embodiment of the present invention. The difference from FIG. 8 referred to in the first embodiment is that, in ST3 (or ST3 ′) of FIG. 9, the control device (controller) 20 performs Packet-Out (ST3) or Ethernet (registered trademark) frame (ST′3). ) To transmit the processing rule sequence, and in ST4 of FIG. 9, the node # 1 identifies and sets the processing rule (flow entry) to be set in the own apparatus from the processing rule sequence. . Hereinafter, a second embodiment of the present invention will be described focusing on the above differences.

FIG. 10 is a diagram illustrating the configuration of a packet with a processing rule sequence that is transmitted to the next hop by the control device (controller) and the node according to the second embodiment of this invention. ST1 in FIG. 10 indicates the user packet 31 transmitted from the host (A) to the node # 1 in ST1 in FIG.

ST3 in FIG. 10 is a processing rule sequence that the control device (controller) 20 that has received an inquiry (processing rule sequence creation request) from the node # 1 transmits to the node # 1 in ST3 or ST′3 in FIG. A packet 32 with a header is shown.

In ST5 of FIG. 10, the node # 1 that has received the packet 32 with the processing rule sequence header from the control device (controller) 20 sets the processing rule (flow entry) to be set in the own device in step ST5 of FIG. Thereafter, a packet 32 with a processing rule sequence header to be transmitted to the node # 2 is shown.

In step ST7 of FIG. 10, the node # 2 that has received the packet 32 with the processing rule sequence header from the node # 1 sets the processing rule (flow entry) to be set in its own device in step ST7 of FIG. The user packet transmitted to the host (B) with the rule string removed is shown.

Here, the mechanism for determining that the processing rule string header and the nodes # 1 and # 2 are the last hop will be described again.

FIG. 11 is a diagram showing a configuration example of the processing rule sequence header 33, and the basic configuration is the same as that shown in FIG. In the example of FIG. 11, the processing rules (processing rule setting information) of the node # 1 and the node # 2 are arranged below the Last Hop Bitmap, and in the DPID # 1 and DPID # 2 fields in which the node identifiers are stored, The node can specify the processing rule to be set in the own device. Further, in the example of FIG. 11, since the node # 2 hits the final hop, the Last hop bitmap is described as “010000000...”.

Subsequently, the operation of the present embodiment will be described with a focus on differences from the first embodiment described above. FIG. 12 is a flowchart showing the operation of the control device (controller) 20 of the second embodiment.

FIG. 12 is a flowchart showing the operation of the control device (controller) 20. Steps S201 to S206 in FIG. 12 are the same as steps S001 to S006 in FIG. 7 showing the operation of the control device (controller) 20 in the first embodiment, and thus description thereof is omitted.

In step S111 of FIG. 6 above, when the inquiry (processing rule sequence creation request) is received from the node 10 and the creation and aggregation of the flow entries are completed, the control device (controller) 20 generates the user packet in step S206. The process rule string thus attached is attached as a process rule string header to create a packet with a process rule string (step S207; user packet modification).

Thereafter, the control device (controller) 20 issues a packet output instruction (Packet-Out) (step S208). This packet output instruction is performed by instructing a packet to be output (packet with a processing rule created in step S207) and an action to be performed on the packet (output from a designated port).

FIG. 13 is a flowchart showing the operation of the node 10 of the second exemplary embodiment. The operations from Steps S301 to S310 in FIG. 13 are the same as those in the first embodiment described above and correspond to Steps S101 to S110 in FIG.

The node 10 that has requested the control device (controller) 20 to create the processing rule sequence in step S312 receives an instruction to output the packet with the processing rule sequence header added as described with reference to FIG. 12 (step S313). .

Next, the node 10 checks whether or not the user packet has been stored (step S314). If the user packet has been stored (Yes in step S314), the node 10 reads the user packet from the packet buffer 14. (Step S316), the processing content (action; output from the designated port) received together with the packet output instruction (Packet-Out) is executed (Step S310).

On the other hand, when the user packet has not been saved (No in step S314), the node 10 checks whether the packet received together with the packet output instruction (Packet-Out) includes a processing rule string (step S315). ), If the process rule string is included (Yes in step S315), the process from step S302 is executed. If the packet received together with the packet output instruction (Packet-Out) does not include a processing rule string (No in step S315), the packet output instruction (for the user packet received together with the packet output instruction (Packet-Out)) ( The processing content (action; here, output from the designated port) received together with Packet-Out is executed (step S310).

After executing the action in step S310, the node 10 determines whether or not the packet including the processing rule sequence has been received (step S311), and if the packet including the processing rule sequence has been received, If the processing is finished and the packet including the processing rule sequence has not been received, the process returns to step S313 to wait for the reception of the packet (Packet-Out) including the processing rule sequence.

As described above, the present invention can also be realized by a form of receiving a packet output instruction (Packet-Out) from the control device (controller) 20. Further, instead of the packet output instruction (Packet-Out), the packet output instruction (Packet-Out) is transmitted from the control device (controller) 20 to the node 10 via the data plane using an Ethernet (registered trademark) frame. This can also be realized by transmitting a packet to which a processing rule sequence equivalent to) is added.

[Third Embodiment]
As described above, the first and second embodiments of the present invention have been described. However, as the number of nodes on the path created by the control device (controller) 20 increases, the processing rule string becomes longer and exceeds the maximum frame length. It can be considered. Hereinafter, a description will be given of a third embodiment in which changes are made so that processing rules can be set for more nodes.

FIG. 14 is a reference diagram and a sequence diagram for explaining a series of flows in the communication system according to the third embodiment of the present invention. The difference from FIG. 9 referred to in the second embodiment is that, in ST3 (or ST3 ′) of FIG. 14, the control device (controller) 20 transmits a setting-dedicated packet (Setup Packet) containing only the processing rule sequence. After that, based on the packet output instruction (Packet-Out) from the control device (controller) 20, the original user packet is transmitted and the node of the last hop of the setting-dedicated packet (Setup Packet) The transfer is stopped. Here, the setting-dedicated packet (Setup Packet) refers to a packet dedicated to setting a processing rule (flow entry) that does not include a user packet portion, rather than adding a processing rule sequence header to the user packet. To do. Hereinafter, a third embodiment of the present invention will be described focusing on the above differences.

FIG. 15 is a diagram showing a detailed configuration of the node 10a of the present embodiment. Referring to FIG. 15, in the node 10 a of this embodiment, a packet delay unit 155 is added in the transfer processing unit 15 in addition to the configuration of the node 10 of the first embodiment.

When the user packet is transmitted after the setting-dedicated packet (Setup Packet) as described above, the packet delay unit 155 causes the flow setting information processing unit 151 to process the flow table 13 via the flow table management unit 12. Before completing the setting of the rule (flow entry), it is installed to delay the input of the packet so that the flow table 13 is not searched by the user packet when the user packet is received.

FIG. 16 is a flowchart showing the operation of the node 10a of the third embodiment. The difference from the node 10 of the second embodiment described with reference to FIG. 13 is whether or not a setting-dedicated packet (Setup Packet) has been received and a user packet has been transmitted after the execution of the action of Step S310. (Step S311a), the process is terminated if the condition is satisfied (Yes in step S311a), and if the condition is not satisfied, the packet output instruction (Packet−) is sent from the control device (controller) 20 in step S313. This is a point of waiting for reception of (Out).

According to the third embodiment of the present invention as described above, it is possible to accommodate more processing rules (flow entries) in the processing rule sequence.

If necessary, the above-described processing rule sequence does not contain processing rules (flow entries) for some nodes 10 on the route, and these some nodes are respectively connected to the control device (controller) 20. A configuration may be adopted in which an inquiry (processing rule sequence creation request) is made. For example, a node on the upstream side of a certain route sets a processing rule (flow entry) in the setting-dedicated packet (Setup Packet) of the third embodiment, and a node on the downstream side individually sets a processing rule ( A configuration for requesting creation and transmission of a flow entry), a configuration for setting a processing rule (flow entry) by a processing rule sequence added to a user packet according to the first and second embodiments, and the like can also be employed.

[Fourth Embodiment]
Next, a description will be given of a fourth embodiment of the present invention in which a function for verifying the validity of a processing rule sequence included in a received packet is added. Hereinafter, since the basic configuration of the present embodiment is the same as that of the third embodiment, the difference will be mainly described below.

FIG. 17 is a block diagram showing a configuration of the node 10b according to the fourth exemplary embodiment of the present invention. The difference from the node 10a of the third embodiment shown in FIG. 15 is that a control device (predetermined between the flow setting information extraction unit 152 of the transfer processing unit 15 and the flow setting information processing unit 151) ( A signature verification unit 156 is added that verifies the signature attached to the processing rule sequence using the public key of the controller 20a and discards the packet whose validity cannot be confirmed.

FIG. 18 is a block diagram showing a configuration of a control device (controller) 20a according to the fourth embodiment of the present invention. The difference from the control device (controller) 20 of the first and second embodiments shown in FIG. 3 is that the message generator 252 uses the private key of the control device (controller) 20a to sign the processing rule string. The signature generation unit 254 for generating the above is added.

FIG. 19 is a diagram illustrating a configuration example of the processing rule string header 33a of the present embodiment. The difference from the processing rule string header 33 of the first and third embodiments described above is that the signature (Signature) created using the information of each field indicated in the signature target range of FIG. 19 at the end of the header. Is added.

FIG. 20 is a flowchart showing the operation of the control device (controller) 20a. The difference from the operation of the control device (controller) 20 of the third embodiment (see the sequence diagram of FIG. 14) is that a process of creating a signature (step S407) is added after the flow entries are aggregated. .

FIG. 21 is a flowchart showing the operation of the node 10b according to the fourth embodiment. The operation is almost the same as when the setting-dedicated packet (Setup Packet) and user packet described with reference to FIG. 16 are transmitted separately, but signature verification is performed when a processing rule sequence is included ( In step S504), if the validity cannot be confirmed, a process of discarding the packet (step S505) is added.

According to the fourth embodiment of the present invention as described above, it is possible to avoid a situation where a processing rule (flow entry) is set by an illegal processing rule sequence, and a more secure network is constructed. It becomes possible.

In the above-described embodiment, the description has been made assuming that an asymmetric key is used. However, a common key may be used, and in such a case, modifications such as adding a function for updating the key as appropriate are possible.

Further, in the above-described embodiment, it has been described that a signature (Signature) of the entire processing rule sequence is created and added. However, a configuration in which a signature is added for each processing rule setting information, and each node receives a packet each time it receives a packet. Modifications such as adding or deleting signatures are also possible.

[Fifth Embodiment]
Next, a fifth embodiment of the present invention will be described in consideration of a packet loss problem in which a packet including a processing rule sequence is discarded for some reason along the route. Since this embodiment can be realized with the same configuration as the first to fourth embodiments, an outline thereof will be described below.

In this embodiment, as shown in FIG. 22, the control device (controller) adds a processing rule sequence including processing rules to be set to the same node from both the first hop side and the last hop side of a route. Packets are transmitted, and processing rules (flow entries) are sequentially set from both directions.

FIG. 23 is a sequence diagram showing a series of flows of the present embodiment. As shown in FIG. 23, when the node # 1 receives a user packet from the host (A) (ST11), the node # 1 makes an inquiry to the control device (controller) 20 (processing rule string). A creation request (Packet-In) is issued (ST12).

Upon receiving the inquiry (processing rule sequence creation request; Packet-In), the control device (controller) 20 creates a route and a processing rule sequence according to the flowchart of FIG. A setting-dedicated packet (SetupPacket) is included in a packet output instruction (Packet-Out) and transmitted to the last hop node # 3 (ST13 and ST14). Although not shown in FIGS. 22 and 23, the control apparatus transmits a setting-dedicated packet (SetupPacket) to the node # 1 and the node # 3 in the form of an Ethernet (registered trademark) frame via the data plane. Is also possible.

The node # 1 and the node # 3 that have received the setting-dedicated packet (SetupPacket) respectively extract and set processing rules to be set from the processing rule sequence (ST15 and ST16), and the next hop determined in the processing rule sequence (ST17, ST19).

Receiving the setting-dedicated packet (SetupPacket), the node # 2 extracts the processing rule (flow entry) to be set by itself from the processing rule sequence included in the setting-dedicated packet (SetupPacket) and sets it in the flow table 13 At the same time (ST18), a setting-dedicated packet (SetupPacket) is transmitted to the next hop (ST20, ST21). In the example of FIG. 23, since the setting-dedicated packet (SetupPacket) from the node # 1 is received first, the process using the setting-dedicated packet (SetupPacket) from the node # 3 is omitted.

After that, when the control device (controller) 20 transmits a packet output instruction (Packet-Out) to the node # 1 (ST22), the user packet passes through the node # 1, the node # 2, and the node # 3, and the host ( B) (ST23 to ST25).

As described above, according to the present embodiment, a setting-dedicated packet (SetupPacket) including an overlapping processing rule (flow entry) is transmitted using a plurality of routes, so that the packet loss is increased, and a node on the route is transmitted. The processing rule (flow entry) can be set more reliably.

In the above-described embodiment, it has been described that a packet including a processing rule sequence is transmitted so that an overlapping interval is generated from both directions. However, the processing is performed by leaving time from the same direction or changing the packet input point. A packet including a rule string may be transmitted.

Further, as described in the third embodiment, when the number of nodes on the route is large, the processing rule is transmitted to more nodes by transmitting a packet including the processing rule sequence so that the overlapping interval is reduced. (Flow entry) can be set.

The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiments, and further modifications, replacements, and replacements may be made without departing from the basic technical idea of the present invention. Adjustments can be made. The control devices (controllers) 20 and 20a of the above-described embodiment can also be realized as dedicated servers. As the

nodes

10, 10a and 10b, in addition to the OpenFlow switch, a router in the IP network, MPLS (Multi- It can be realized with an MPLS switch in a Protocol Label Switching network. In addition, the present invention can be applied to any network where the server centrally manages nodes in the network.

Further, in each of the above-described embodiments, by including a node identifier (DPID) in each processing rule setting information in the processing rule string, each node specifies a processing rule (flow entry) to be set in its own device. As explained above, the method of using the processing rule setting information at the beginning or end of the processing rule column and setting the used flag indicating that the processing rule setting information has been used, and the process used for the setting It is also possible to adopt a method in which each node sequentially deletes the rule setting information from the processing rule string.

In addition, each disclosure of the above non-patent literature shall be incorporated into this book with reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiment can be changed and adjusted based on the basic technical concept. Various combinations and selections of various disclosed elements are possible within the scope of the claims of the present invention. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

In each of the above-described embodiments, the last hop node has been described as removing the processing rule string header. However, a configuration in which the removal is performed on the host side can also be employed.

Finally, a preferred form of the invention is summarized.
[First embodiment]
(Refer to the communication system according to the first viewpoint)
[Second form]
In the first form,
In the communication system, the processing rule sequence includes processing rules that a plurality of nodes of the data transfer network should set in each processing rule storage unit.
[Third embodiment]
In the first and second embodiments, each of the nodes specifies a processing rule to be set by the own device based on a node identifier associated with each processing rule in the processing rule string.
[Fourth form]
The communication system according to any one of the first to third embodiments, wherein each node transfers a packet including the processing rule sequence based on output destination information attached to the processing rule sequence.
[Fifth embodiment]
In any one of the first to fourth forms, the packet includes information on a last hop node, and the last hop node deletes the processing rule string or transfers the packet. Communication system to stop.
[Sixth embodiment]
In any one of the second, fourth, and fifth modes, the processing rules in the processing rule sequence are arranged in the order of the nodes on the packet transfer path, and the nodes are sequentially The processing rule to be set by each node is deleted by deleting the processing rule set in the processing rule storage unit of its own device from the packet or by writing that the processing rule has been used in a predetermined area of the packet. The communication system to identify.
[Seventh form]
The communication system according to any one of the first to sixth aspects, wherein the processing rule sequence is added to a user packet in the form of an additional header.
[Eighth form]
In any one of the first to seventh aspects, the packet is attached with an electronic signature indicating the validity of the processing rule string or each processing rule, and each node has the processing rule. A communication system that verifies the validity of an electronic signature of a column or individual processing rule, and sets the processing rule when the validity is confirmed.
[Ninth Embodiment]
The control apparatus according to any one of the first to eighth embodiments, wherein the processing rule sequence or a packet including the processing rule sequence is generated and transmitted to a node that is a starting point of the packet including the processing rule sequence. A communication system including:
[Tenth embodiment]
In any one of the first to ninth aspects, the control device includes a processing rule sequence including a processing rule to be set in the same node for a plurality of nodes on the path of the packet, or A communication system that creates and transmits a packet including a processing rule sequence to be set in the same node.
[Eleventh form]
(Refer to the node from the second viewpoint above)
[Twelfth embodiment]
In the eleventh form,
The processing rule sequence is a node configured by processing rules to be set in each processing rule storage unit by a plurality of nodes of the data transfer network.
[13th form]
In the eleventh and twelfth aspects, the node that specifies a processing rule to be set by the own apparatus based on a node identifier associated with each processing rule in the processing rule string.
[14th form]
The node according to any one of the eleventh to thirteenth aspects, which forwards a packet including the processing rule sequence based on output destination information attached to the processing rule sequence.
[15th form]
In any one of the eleventh to fourteenth forms, if the information on the last hop node included in the packet indicates that the own apparatus is the last hop node, the processing rule sequence is deleted or the A node that stops forwarding packets.
[Sixteenth embodiment]
In any one of the twelfth, fourteenth, and fifteenth forms, the processing rules in the processing rule sequence are arranged in the order of the nodes on the packet transfer path, and the nodes are sequentially A node that specifies a processing rule to be set by each node by deleting the processing rule from the processing rule sequence or writing that the processing rule has been used in a predetermined area of the packet.
[17th form]
In any one of the eleventh to sixteenth modes, a processing rule to be set in the processing rule storage unit of the own device is set from the processing rule sequence stored in the additional header added to the user packet. Node to perform.
[18th form]
In any one of the eleventh to seventeenth aspects, the validity of the processing rule sequence added to the packet or the electronic signature of the processing rule to be set in the own device is verified, and the validity is confirmed. A node for setting the processing rule when it is detected.
[19th form]
(Refer to the control server from the third viewpoint)
[20th form]
In the nineteenth aspect, the control server creates a processing rule sequence composed of processing rules to be set in each processing rule storage unit by a plurality of nodes of the data transfer network.
[21st form]
In the nineteenth and twentieth embodiments, the control server transmits a packet in which a processing rule and a node identifier of a node to which the processing rule is set are associated as the processing rule string.
[Twenty-second embodiment]
The control server according to any one of the nineteenth to twenty-first aspects, wherein output destination information indicating a transfer destination of a packet including the processing rule sequence is attached to the processing rule sequence.
[23rd form]
In any one of the nineteenth to the twenty-second embodiments, the control server transmits a packet including information on the last hop node for deleting the processing rule string or stopping the packet transfer to the last hop node. .
[24th form]
In any one of the twentieth, twenty-second, and twenty-third forms, the control server creates a processing rule sequence in which processing rules are arranged in the order of the nodes on the packet transfer path.
[25th form]
The control server according to any one of 19th to 24th aspects, wherein the processing rule sequence is added to the user packet in the form of an additional header.
[26th form]
The control server according to any one of the nineteenth to twenty-fifth aspects, wherein the control server transmits a packet to which an electronic signature indicating the validity of the processing rule sequence or each processing rule is added.
[27th form]
In any one of the nineteenth to twenty-sixth aspects, a processing rule sequence including a processing rule to be set in the same node for a plurality of nodes on the packet path, or a process to be set in the same node A control server that creates and sends a packet containing a rule string.
[Twenty-eighth embodiment]
(Refer to the communication method according to the fourth viewpoint.)
[29th form]
(Refer to the program from the fifth viewpoint above)
[Thirty Embodiment]
(Refer to the program from the sixth viewpoint)

10, 10a, 10b Node 11 Controller communication unit 12 Flow table management unit 13 Flow table
14 Packet buffer 15

Transfer processing unit

20, 20a Control device 21 Flow entry database (flow entry DB)
22 Topology management unit 23 Route / action calculation unit 24 Flow entry management unit 25 Control message processing unit 26 Node communication unit 31 User packet 32 Packet with processing

rule sequence header

33, 33a Processing rule sequence header 151 Flow setting information processing unit 152 Flow setting Information extraction unit 153 Table search unit 154 Action execution unit 155 Packet delay unit 156 Signature verification unit 251 Message analysis / processing unit 252 Message generation unit 253 Flow entry aggregation unit 254 Signature generation unit

Claims

A packet including a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network is received, and a processing rule to be set in the processing rule storage unit of the own device is received from the processing rule sequence A communication system comprising: a node that is extracted and set.
2. The communication system according to claim 1, wherein the processing rule sequence is configured by processing rules to be set in each processing rule storage unit by a plurality of nodes of the data transfer network.
The communication system according to claim 1 or 2, wherein each of the nodes specifies a processing rule to be set by the own device based on a node identifier associated with each processing rule in the processing rule string.
The communication system according to any one of claims 1 to 3, wherein each of the nodes transfers a packet including the processing rule sequence based on output destination information attached to the processing rule sequence.
The communication system according to any one of claims 1 to 4, wherein the packet includes information on a node of a last hop, and the node of the last hop deletes the processing rule sequence or stops forwarding the packet.
The processing rules in the processing rule sequence are arranged in the order of the nodes on the transfer path of the packet,
Each node sequentially deletes the processing rule set in the processing rule storage unit of its own device from the packet or writes that the processing rule has been used in a predetermined area of the packet, so that each node The communication system according to any one of claims 2, 4, and 5, wherein a processing rule to be set is specified.
The communication system according to any one of claims 1 to 6, wherein the processing rule sequence is added to a user packet in the form of an additional header.
The packet is attached with an electronic signature indicating the validity of the processing rule string or individual processing rules,
The communication according to any one of claims 1 to 7, wherein each node verifies the validity of the electronic signature of the processing rule string or each processing rule, and sets the processing rule when the validity is confirmed. system.
The communication system according to any one of claims 1 to 8, further comprising a control device that creates and transmits the processing rule sequence or a packet including the processing rule sequence to a node serving as a starting point of the packet including the processing rule sequence.
The control device creates and transmits a processing rule sequence including a processing rule to be set to the same node or a packet including a processing rule sequence to be set to the same node to a plurality of nodes on the path of the packet. The communication system according to claim 9.
Located in the data transfer network,
A processing rule to be set in the processing rule storage unit of its own device is received from the processing rule sequence by receiving a packet including a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network The node to extract and set
12. The node according to claim 11, wherein the processing rule sequence is configured by processing rules to be set in each processing rule storage unit by a plurality of nodes of the data transfer network.
13. The node according to claim 11 or 12, wherein a processing rule to be set by the own device is specified based on a node identifier associated with each processing rule in the processing rule string.
The node according to any one of claims 11 to 13, wherein a packet including the processing rule sequence is transferred based on output destination information attached to the processing rule sequence.
15. The information on the last hop node included in the packet indicates that the device is the last hop node, and deletes the processing rule string or stops forwarding the packet. node.
The processing rules in the processing rule sequence are arranged in the order of the nodes on the transfer path of the packet,
Each node sequentially deletes the processing rule from the processing rule string or writes that the processing rule has been used in a predetermined area of the packet, thereby specifying the processing rule to be set by each node. The node according to claim 12, 14, or 15.
The node according to any one of claims 11 to 16, wherein the processing rule to be set in the processing rule storage unit of the own device is extracted from the processing rule sequence stored in the additional header added to the user packet and set.
18. The validity of the processing rule string added to the packet or the electronic signature of the processing rule to be set in the device is verified, and the processing rule is set when the validity is confirmed. One of the nodes.
Based on the information included in the input packet received from the node arranged in the data transfer network, create a processing rule sequence configured by arranging the processing rules to be set in the processing rule storage unit of the node of the data transfer network, A control server that transmits a packet including the processing rule sequence to a node that has transmitted the input packet.
20. The control server according to claim 19, wherein a plurality of nodes of the data transfer network create a processing rule sequence composed of processing rules to be set in each processing rule storage unit.
21. The control server according to claim 19 or 20, wherein a packet in which a processing rule is associated with a node identifier of a node for which the processing rule is to be set is transmitted as the processing rule string.
The control server according to any one of claims 19 to 21, wherein output destination information indicating a transfer destination of a packet including the processing rule sequence is attached to the processing rule sequence.
The control server according to any one of claims 19 to 22, wherein the control server transmits a packet including information on a last-hop node for deleting the processing rule string or stopping the packet transfer to a last-hop node.
24. The control server according to any one of claims 20, 22, and 23, which creates a processing rule sequence in which processing rules are arranged in the order of nodes on the packet transfer path.
The control server according to any one of claims 19 to 24, wherein the processing rule sequence is added to a user packet in the form of an additional header.
The control server according to any one of claims 19 to 25, which transmits a packet to which an electronic signature indicating the validity of the processing rule sequence or individual processing rules is added.
The processing rule string including a processing rule to be set in the same node or a packet including a processing rule string to be set in the same node is generated and transmitted to a plurality of nodes on the packet path. 26 any one control server.
Including, in an input packet, a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network;
A method in which a node of the data transfer network extracts and sets a processing rule to be set in a processing rule storage unit of its own device from a processing rule sequence included in the input packet.
A node of a data transfer network receives a packet including a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of the node of the data transfer network;
A step in which the node extracts and sets a processing rule to be set in a processing rule storage unit of the own device from a processing rule sequence included in the input packet.
A control device that controls a node arranged in the data transfer network includes, in an input packet, a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network;
And a step of transmitting the packet including the processing rule sequence to a node of the data transfer network.
A program to be executed by a computer constituting a node arranged in a data transfer network,
A processing rule to be set in the processing rule storage unit of its own device is received from the processing rule sequence by receiving a packet including a processing rule sequence configured by arranging processing rules to be set in a processing rule storage unit of a node of the data transfer network Processing to take out
A program for executing the processing for setting the extracted processing rule in the processing rule storage unit of the device itself.
A program to be executed by a computer constituting a control device that controls a node arranged in a data transfer network,
Based on information included in an input packet received from a node arranged in the data transfer network, a processing rule sequence in which processing rules to be set in each processing rule storage unit of the data transfer network node are arranged is created. Processing to
A program for causing a node that has transmitted the input packet to execute a process of transmitting a packet including the processing rule sequence.